Windows Codex Sandbox creating Event Errors 4625.

What issue are you seeing?

• ### Bug summary

CODEX GENERATED REPORT

On Windows, the managed Codex sandbox intermittently generates failed NTLM authentication events against the host’s local SMB service.

### Observed event details

Security event: 4625
Logon type: 3 (Network)
Authentication package: NTLM
Source IP: 127.0.0.1
Destination: 127.0.0.1:445
Source port: Ephemeral/changing
Target account: <HOST_DOMAIN>\<HOST_USER>
Workstation: <HOST_NAME>

Sysmon Event ID 3 correlated the connection as:

Image: System
Process ID: 4
Protocol: TCP
Source: 127.0.0.1:<EPHEMERAL_PORT>
Destination: 127.0.0.1:445

Commands within the workspace run as a separate account:

<HOST_NAME>\<SANDBOX_ACCOUNT>

### Behaviour

The events appeared while using the managed sandbox. Each occurrence used a different source port. The sandbox continued operating normally after
authentication failed.

Controlled tests did not consistently reproduce the event. These actions alone produced no new 4625 event:

• Starting a basic PowerShell command
• Running Get-SmbConnection
• Running net use
• Reading the Security event log

The trigger may involve an intermittent sandbox-broker operation, privilege transition, or host-resource hand-off that attempts loopback SMB
authentication using the interactive user’s identity.

### Expected behaviour

Sandbox operations should not attempt unusable NTLM authentication against the host’s loopback SMB service or generate noisy Security 4625 audit
events.

### Additional notes

• The traffic did not target another network device.
• Existing SMB mappings were healthy.
• No persistent or stale SMB mapping explained the loopback traffic.
• The issue appears specific to communication between the isolated sandbox account and the host user context.

What steps can reproduce the bug?

Codex testing could not isolate a fixed command. Timings are 10 minutes to several hours.

What is the expected behavior?

_No response_

Additional information

_No response_